How to detect FS installed?

NTFSD
1

Hi!

As it is known that FSD are installed as kernel service, if certain FS does not exist in the system, the corresponding FSD will not be installed during boot. I installed a virtual machine without FAT file system, I found that fastfat.sys did not be installed! And, if I try to attach the object for fastfat, the machine crashed!

So, I have to detect what FS have been installed in the system before trring to attach my Filter Object to certain object for FSD. Then, how can I detect all the FSD have been installed in FS Filter Driver?

Thanks! :slight_smile:

2

How are you doing things? Filters layer on volumes with file systems so
you should not have to worry about whether an FSD exists, only if it is
under you when the filter is being loaded. It sounds like you are trying
something entirely different.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

wrote in message news:xxxxx@ntfsd…
> Hi!
>
> As it is known that FSD are installed as kernel service, if certain FS
> does not exist in the system, the corresponding FSD will not be installed
> during boot. I installed a virtual machine without FAT file system, I
> found that fastfat.sys did not be installed! And, if I try to attach the
> object for fastfat, the machine crashed!
>
> So, I have to detect what FS have been installed in the system before
> trring to attach my Filter Object to certain object for FSD. Then, how
> can I detect all the FSD have been installed in FS Filter Driver?
>
> Thanks! :slight_smile:
>

3

I may not express myself well!

I want to attach my FS filter device object to file system device object in DriverEntry statically. I tried that if I want to attach my filter device object to device object for FAT, the computer crash down, because all my volumes are NTFS file system! And I saw that FSD for FAT was not installed before a FAT volume is mounted.

So I have to detect what FS have already been installed! Now, I have a idea that get the object for each FS by FS object name. But, I think there may be a better way to do so!

4

Assuming this is a legacy filter, you should be calling your registratrion
routine through IoRegisterFsRegistrationChange or through the raw device.
Take a look at Sfilter. It sounds like you are trying to do an
IoAttachDevice to something you shouldn’t.

Actually, I would recomend you consider changing to the minifilter model,
then this attach is extremely simple.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

wrote in message news:xxxxx@ntfsd…
>I may not express myself well!
>
> I want to attach my FS filter device object to file system device object
> in DriverEntry statically. I tried that if I want to attach my filter
> device object to device object for FAT, the computer crash down, because
> all my volumes are NTFS file system! And I saw that FSD for FAT was not
> installed before a FAT volume is mounted.
>
> So I have to detect what FS have already been installed! Now, I have a
> idea that get the object for each FS by FS object name. But, I think
> there may be a better way to do so!
>

5

> I want to attach my FS filter device object to file system device object

in DriverEntry statically. I tried that if I want to attach my filter
device object to device object for FAT, the computer crash down, because
all my volumes are NTFS file system! And I saw that FSD for FAT was not
installed before a FAT volume is mounted.
Really, something is wrong in this picture.

Look, the way it works is that file system drivers are loaded only as
necessary; FAT(NTFS, whatever) driver is loaded only when you mount
(the first) FAT(NTFS, whatever) volume.

Instead if keeping all full-blown file system drivers loaded and running all
the time, Windows has (small and cheap) FS recognizers at hand, one for
each file system, so that when a new volume comes into play, the kernel
asks each of them “is it your volume?” and, if the answer is yes, starts
the file system driver (big and expensive) per se - that is, if FSD is not
already running.

Now: you say that “all my volumes are NTFS”, it follows that fastfat.sys
is not running yet (= present in the system but not loaded), at the same
time you want to “attach my filter device object to device object for FAT”

  • but there is no such thing just yet!

You noticed it yourself: “I saw that FSD for FAT was not installed before
a FAT volume is mounted”. Exactly!

There are (more than a couple of) articles about this on OSR’s site, you
may want to read them.

As has been pointed out, you’d be better off by catching the moment
when FAT does come into play, and this is exactly what
IoRegisterFsRegistrationChange does - “aha! a new file system has
been started!”

Hope it helps.

----- Original Message -----
From: “Don Burn”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Saturday, October 21, 2006 4:01 PM
Subject: Re:[ntfsd] How to detect FS installed?

> Assuming this is a legacy filter, you should be calling your registratrion
> routine through IoRegisterFsRegistrationChange or through the raw device.
> Take a look at Sfilter. It sounds like you are trying to do an
> IoAttachDevice to something you shouldn’t.
>
> Actually, I would recomend you consider changing to the minifilter model,
> then this attach is extremely simple.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> http://www.windrvr.com
> Remove StopSpam from the email to reply
>
>
>
> wrote in message news:xxxxx@ntfsd…
>>I may not express myself well!
>>
>> I want to attach my FS filter device object to file system device object
>> in DriverEntry statically. I tried that if I want to attach my filter
>> device object to device object for FAT, the computer crash down, because
>> all my volumes are NTFS file system! And I saw that FSD for FAT was not
>> installed before a FAT volume is mounted.
>>
>> So I have to detect what FS have already been installed! Now, I have a
>> idea that get the object for each FS by FS object name. But, I think
>> there may be a better way to do so!
>>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Thanks, Alex!

I have a deep understanding of FSD through your reply! :slight_smile: